- An Iranian Hacking group called MuddyWater is using a new backdoor Malware named UDPGangster that exploits UDP for command-and-control operations.
- The malware targets systems in Turkey, Israel, and Azerbaijan through spear-phishing emails with malicious Microsoft Word attachments.
- UDPGangster employs multiple anti-analysis techniques to detect virtual environments and avoid detection before collecting data and executing commands via UDP connections.
- The infection begins when victims enable macros in Word documents that run embedded VBA scripts to deploy the backdoor.
- The activity follows recent attacks linked to MuddyWater involving another backdoor, MuddyViper, targeting various sectors within Israel.
An Iranian cyber espionage group known as MuddyWater has been observed deploying a new backdoor called UDPGangster since late 2025. This malware uses the User Datagram Protocol (UDP) for its command-and-control (C2) communications and primarily targets users in Turkey, Israel, and Azerbaijan, according to Cybersecurity researchers.
The attack method begins with spear-phishing emails that impersonate entities such as the Ministry of Foreign Affairs of the Turkish Republic of Northern Cyprus. These messages include a ZIP file attachment containing a Microsoft Word document named “seminer.doc,” which prompts recipients to enable macros. Activating the macros runs a VBA script that secretly executes the UDPGangster payload. The script also displays a decoy image, in Hebrew, related to telecom outages in Israel to distract victims.
“The macro uses the Document_Open() event to automatically execute, decoding Base64-encoded data from a hidden form field and writing the decoded content to C:\Users\Public\ui.txt,” explained security researcher Cara Lin. “It then executes this file using the Windows API CreateProcessA, launching the UDPGangster payload.”
Once active, UDPGangster establishes persistence by modifying the Windows Registry and incorporates a variety of anti-analysis techniques. These include checks for debugging tools, Sandbox environments, virtual machines, available system memory, and network adapter information. It also scans for known virtualization software processes and environment markers, ensuring it operates only in real user environments.
After confirming it is not under analysis, the malware collects system information and communicates with a remote C2 server at IP address 157.20.182.75 over UDP port 1269. Through this channel, attackers can run commands, transmit files, update the malware, and deploy additional payloads.
This campaign coincides with recent attacks by MuddyWater that delivered another backdoor called MuddyViper. Those attacks affected sectors including academia, engineering, local government, manufacturing, technology, transportation, and utilities within Israel.
Security experts caution users to be wary of unsolicited documents that request macro activation and highlight the sophisticated evasion tactics used by UDPGangster. Further details on the malware’s behavior and mitigation strategies are available according to Cara Lin.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
